OK, I've read the issues with using e2fsck on mounted partitions but, I did not read them until after I had done it! Now that I have effed up is there any steps I can take to save the info? The partition is ext3.

Thanks

04-17-2009

devils casper

Hi and Welcome !

Didn't e2fsck throw error?
Is there any data loss? Are you able to mount partition and view its data?

04-17-2009

Rubberman

Well, if it is accessible, then good. Unmount it and re-run e2fsck to see if there are errors. If not, you are home free. If so, then they will probably be fixable. The main problem with running fsck on a mounted files system is that someone or some process may update the drive while the tool is running. If that didn't happen, then it is likely you are OK. I've done that before myself, and dodged the same bullet you are looking at.

04-17-2009

magic-chef

The answer to both responses is no! I have tried not the do anything until I have a path to follow. I am trying not to lose all the data.

What should I do to move froward?

04-17-2009

Lostfarmer

If the data is important would first make a exact copy of partition to work on. You can use 'dd' to do it but I'm not sure of the exact command or if it is the best, there are other cloning software also. You should use a 2nd hdd but partition of same or larger size on same hdd could be used.

04-18-2009

Jonathan183

Shutdown the system and boot from a live CD is a good start. Copy the partition if it has vital data on ... considering you are asking about e2fsck I suggest you use a live CD for the purpose rather than dd command directly - if you get things the wrong way round it will wipe the partition :eek:

Once you have backed up the partition if you feel you need to then boot from a live CD (don't mount the partition) and run e2fsck ... after that try to mount the partition.

04-18-2009

Rubberman

Quote:

Originally Posted by Lostfarmer

If the data is important would first make a exact copy of partition to work on. You can use 'dd' to do it but I'm not sure of the exact command or if it is the best, there are other cloning software also. You should use a 2nd hdd but partition of same or larger size on same hdd could be used.

As Jonathan183 said, boot from a liveCD or recovery disk. Don't mount the drive, but back it up - I recommend making a bit-image copy of the entire disc so it can be restored in its entirety if necessary. The dd command works, or you can run cat. What I do in these situations is to mount an external drive, such as a USB or eSata hard drive that has enough space for a compressed image of the disc. Normally I format such a device with an ext2 file system (a journalling file system like ext3 is not necessary for this). Then I cat and compress the data using a command like this: cat /dev/sda | gzip -c >/mnt/tmpdrv/sda_backup.gz ---- where the external disc is mounted on /mnt/tmpdrv. Gzip is preferable to bzip2 as bzip2 is WAAYYY too slow for this volume of data for the extra bit of compression you get.

After I make the bit-image backup I check the integrity of the compromised drive with fsck using the -n option (unless it is a reiser file system) so it will check the drive but not try to fix anything. If it doesn't report any errors, then I reboot the system and go on with my life. If it gets errors, I evaluate them to see if I should re-run fsck. Whether or not I do before I try to extract the data from the file system is a value judgment and depends upon a lot of factors which cannot be stated easily. If I decide to re-run fsck before I try to access my data then I will do it with the -y option to fix any errors without interaction. This is a good idea if there are a lot of errors and I don't want to spend several hours typing 'y' and pressing the Enter key.

If there were errors, I will try to copy any data that I don't want to lose to another drive. Since we haven't yet mounted the drive we are trying to recover, we would do that now, and copy the data files we need to another device. If I can get all the data I need, then we can unmount and reformat the disc. If we haven't re-run fsck, we will do that now and try to access the files we were unable to in the last step. If we still cannot access that data, then we go from there... Recovery from such situations is why people pay people like me a lot of $$ for these services. :-)

Good luck, and let us know how it goes. We will try to help as much as possible - we've all been there, done that, ouch!

04-18-2009

magic-chef

Thanks Rubberman.

It seem seems that I have a lot of work ahead. With limited knowledge as is evidenced by the problem in the first place.

I have already booted up my computer with systemrescuecd.

How do I check for the partitions/drives?

I will research the dd command in the mean time.

04-18-2009

magic-chef

Sorry about that! I rescind my last question.

04-18-2009

Rubberman

Quote:

Originally Posted by magic-chef

Sorry about that! I rescind my last question.

Huh? I was just going to say that I'd get back to you with details as soon as I finish my lunch! So, wazup?